Bug 2537142

Summary: CVE-2026-59184 usd: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: usdAssignee: Luya Tshimbalanga <luya_tfz>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: adriacabellocrespo, ali.koroglu, code, luya_tfz, multimedia-sig, negativo17
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["40a47237-0a54-4d2d-a7d0-99df32d4fb49"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2523654    

Description Vladimir Vasilev 2026-09-19 11:24:39 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row() return an invalid heap pointer, causing out-of-bounds or use-after-free writes. This occurs when an application writes rows through FlatHalfChannel::row(). Affected consumers are tools, converters, render pipeline components, or image-processing services that accept untrusted EXR files and use FlatHalfChannel::row() on loaded images. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Comment 1 Ben Beasley 2026-09-19 21:40:48 UTC 
I’ve tried backporting some fixes from OpenEXR upstream in the past, but the CVE’s keep piling up, and downstream backporting of dozens of patches is not sustainable. The vendored OpenEXR has been updated upstream in https://github.com/PixarAnimationStudios/OpenUSD/commit/8ca068a2d06ef84a534776ac7b97973e00f6be7a, fixing dozens of CVE’s. This change isn’t a good candidate for backporting, but it should be present in the next upstream release, which will be ABI-incompatibile and therefore won’t be shipped in stable releases.